diff options
author | Stanislav Malyshev <stas@php.net> | 2016-11-26 14:48:50 -0800 |
---|---|---|
committer | Stanislav Malyshev <stas@php.net> | 2016-11-26 14:48:50 -0800 |
commit | dd7eee06090752cf4eb20a79cc6f47bf65aa2d4f (patch) | |
tree | 9103680566fe96177e228dcabd1593ed1b986949 | |
parent | 09085ac02ce8f5fe34eb6f5a3dbb0abb5f1d821f (diff) | |
parent | 58cdd03d9267db3ee62a084492af3cdd12b86cdc (diff) | |
download | php-git-dd7eee06090752cf4eb20a79cc6f47bf65aa2d4f.tar.gz |
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
Add more mbfl string size checks (bug #73505)
-rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c | 28 | ||||
-rw-r--r-- | ext/standard/string.c | 2 |
2 files changed, 28 insertions, 2 deletions
diff --git a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c index 29782f5931..c4d4e7fe37 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c +++ b/ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c @@ -146,6 +146,10 @@ mbfl_memory_device_output(int c, void *data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -169,6 +173,10 @@ mbfl_memory_device_output2(int c, void *data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -194,6 +202,10 @@ mbfl_memory_device_output4(int c, void* data) unsigned char *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -227,6 +239,10 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc) if ((device->pos + len) >= device->length) { /* reallocate buffer */ int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char); + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -254,6 +270,10 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len if ((device->pos + len) >= device->length) { /* reallocate buffer */ int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE; + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -281,6 +301,10 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src) if ((dest->pos + src->pos) >= dest->length) { /* reallocate buffer */ int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE; + if (newlen <= 0) { + /* overflow */ + return -1; + } unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char)); if (tmp == NULL) { return -1; @@ -336,6 +360,10 @@ mbfl_wchar_device_output(int c, void *data) unsigned int *tmp; newlen = device->length + device->allocsz; + if (newlen <= 0) { + /* overflow */ + return -1; + } tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int)); if (tmp == NULL) { return -1; diff --git a/ext/standard/string.c b/ext/standard/string.c index c41d48ef17..d0ebd2f5be 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -20,8 +20,6 @@ /* $Id$ */ -/* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ - #include <stdio.h> #include "php.h" #include "php_rand.h" |